Suspicious Execution of Shutdown or Reboot Command

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects the execution of the 'shutdown.exe' command-line utility with parameters '/r' (reboot) or '/s' (shutdown). This activity can be indicative of an adversary attempting to impact system availability by shutting down or rebooting a Windows system.